# Liquidation ignores accrued interest

Health or debt math using stale principal or snapshot values instead of accrued interest and current totals

_Area: DeFi oracles, liquidations and flash loans. Seen in 16 disclosed reports; latest 2026-03-09. Updated 2026-10-22._

## How it works
Liquidation decisions compare collateral value against debt. The assumption that breaks is that the stored debt or collateral figure equals the true economic value at the moment of the check. When debt is read as principal only, or collateral is read from a snapshot taken at deposit time, the health factor is computed against a number that no longer reflects reality. Interest accrues, positions drift, and the check either understates debt (liquidating too late) or understates collateral (liquidating too early).

## Where it shows up
- Health-factor or LTV formulas reading `assetAmount`/principal instead of `repaymentAmount` (principal + interest) [E8](https://bugbountylibrary.com/r/cantina%3Ahyperlend_november2024%3A3.2.1.md)
- Collateral value derived from a field set once at deposit and never incremented for interest [E3](https://bugbountylibrary.com/r/sherlock%3A2023-02-blueberry%3AH-7.md)
- Liquidation math mixing a stored accumulator (assets) with a freshly simulated index (debt) at different timestamps [E6](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-14.md)
- Borrow aggregation helpers that silently exclude inbound cross-chain debt, returning zero max repay [E7](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-8.md)
- Periphery contracts reimplementing closable/health loops with different bounds than the canonical check [E2](https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AM-9.md)
- Liquidation paths that reduce pair totals without zeroing the borrower's per-user shares [E4](https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AH-01.md)

## How to review
For every field entering the health-factor or liquidation formula, trace where it is written and confirm it tracks true economic value at the current timestamp, not a deposit-time snapshot. The invariant: collateral and debt must both be valued as of the same block/timestamp, and debt must include all accrued interest and all borrow origins. Check that every liquidation path updates the same accounting state, and that any helper named for "borrows" or "closable" includes the same set the canonical check does.

## Variants seen
- Principal vs repayment in threshold check [E8](https://bugbountylibrary.com/r/cantina%3Ahyperlend_november2024%3A3.2.1.md)
- Stale collateral snapshot ignoring interest [E3](https://bugbountylibrary.com/r/sherlock%3A2023-02-blueberry%3AH-7.md)
- Stored vs simulated index timestamp skew [E6](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-14.md)
- Cross-chain borrows omitted from max-repay [E7](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-8.md)
- Periphery loop bounds diverging from canonical [E2](https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AM-9.md)
- Leftover shares enabling repeated no-op liquidations [E4](https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AH-01.md)
- Bad debt not written off, first-exit advantage [E5](https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AH-02.md)
- Interest-rate manipulation via unaccrued markets [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-29.md)

## Why fixes fail
E1's fix gated re-accrual on one caller (`msg.sender == bigBangEthMarket`), but the leverage path calls `_borrow()` directly, bypassing the gate. Gating a mitigation on a specific caller leaves every other path that mutates the same state unprotected.

## Impact and severity
Premature liquidation of solvent users [E3](https://bugbountylibrary.com/r/sherlock%3A2023-02-blueberry%3AH-7.md), late liquidation letting lenders absorb interest and fees [E8](https://bugbountylibrary.com/r/cantina%3Ahyperlend_november2024%3A3.2.1.md), blocked valid liquidations [E7](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-8.md), overstated protocol loss [E6](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-14.md), and locked funds from repeated liquidations [E4](https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AH-01.md). Severity rises when liquidation bonus math amplifies the skew [E6](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-14.md) or when bad debt is left in totals, shifting losses to later depositors [E5](https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AH-02.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-29.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AM-9.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-02-blueberry%3AH-7.md
- E4: https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AH-01.md
- E5: https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AH-02.md
- E6: https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-14.md
- E7: https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-8.md
- E8: https://bugbountylibrary.com/r/cantina%3Ahyperlend_november2024%3A3.2.1.md